🚨 CVE-2026-113350
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's authenticated session when the administrator clicks the rendered link.

🎖@cveNotify

🚨 CVE-2026-113351
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

🎖@cveNotify

🚨 CVE-2026-113352
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

🎖@cveNotify

🚨 CVE-2026-113353
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

🎖@cveNotify

🚨 CVE-2026-113354
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

🎖@cveNotify

🚨 CVE-2026-113355
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

🎖@cveNotify

🚨 CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.

🎖@cveNotify

🚨 CVE-2026-113357
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.

🎖@cveNotify

🚨 CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve private uploads from local storage or configured remote S3 disks.

🎖@cveNotify

🚨 CVE-2026-113382
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue. The name of the patch is 04573681420295f7b327c9da3b101aed2f3cf432. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

🎖@cveNotify

🚨 CVE-2026-113383
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

🎖@cveNotify

🚨 CVE-2026-113384
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

🎖@cveNotify

🚨 CVE-2026-9589
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.



The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.



Exploitation requires an authenticated session but no user interaction.

🎖@cveNotify

🚨 CVE-2025-49300
Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.

🎖@cveNotify

🚨 CVE-2026-105311
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

🎖@cveNotify

🚨 CVE-2026-105312
A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

🎖@cveNotify

🚨 CVE-2026-105949
Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

🎖@cveNotify

🚨 CVE-2026-113385
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 9.0.90 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

🎖@cveNotify

🚨 CVE-2026-113388
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: "While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code."

🎖@cveNotify

🚨 CVE-2026-113389
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

🎖@cveNotify

🚨 CVE-2026-113495
A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period.

🎖@cveNotify